Joomla! cross-site scripting vulnerability (CNVD-2021-38294)

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site scripting vulnerability exists in Joomla! versions 3.0.0 through...

Joomla! 3.0.0 - 3.9.26 Multiple Vulnerabilities

Joomla! is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla"; ifdescription...

Arbitrary File Deletion Vulnerability in Joomla!

SP Page Builder plugin is a free page builder component that users can use on joomla sites to design and edit site page content. An arbitrary file deletion vulnerability exists in Joomla! SP Page Builder, which can be exploited to delete arbitrary files on the target server...

Joomla! cross-site request forgery vulnerability (CNVD-2021-38296)

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site request forgery vulnerability exists in combanners and comsysinfo in...

Joomla! cross-site request forgery vulnerability (CNVD-2021-38295)

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site request forgery vulnerability exists in the AJAX reordering endpoint...

CVE-2021-26033

An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint...

CVE-2021-26034

An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in combanners and comsysinfo...

CVE-2021-26032

An issue was discovered in Joomla! 3.0.0 through 3.9.26. HTML was missing in the executable block list of MediaHelper::canUpload, leading to XSS attack vectors...

CVE-2021-26032

An issue was discovered in Joomla! 3.0.0 through 3.9.26. HTML was missing in the executable block list of MediaHelper::canUpload, leading to XSS attack vectors...

CVE-2021-26034

An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in combanners and comsysinfo...

CVE-2021-26033

An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint...

Cross site request forgery (csrf)

An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in combanners and comsysinfo...

Design/Logic Flaw

An issue was discovered in Joomla! 3.0.0 through 3.9.26. HTML was missing in the executable block list of MediaHelper::canUpload, leading to XSS attack vectors...

Cross site request forgery (csrf)

An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint...

CVE-2021-26033

CVE-2021-26033 affects Joomla! 3.0.0–3.9.26 with a missing token check in the AJAX reordering endpoint, enabling CSRF. The issue is documented across multiple sources (NVD, OSV, CNVD, etc.). The vulnerability has been addressed in later Joomla! releases; a public indicator notes fixed in version ...

CVE-2021-26034 [20210503] - Core - CSRF in data download endpoints

An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in combanners and comsysinfo...

CVE-2021-26034

CVE-2021-26034 concerns Joomla! versions 3.0.0–3.9.26, where a missing CSRF token check in data download endpoints of the components com_banners and com_sysinfo enables cross-site request forgery. The issue is rooted in insufficient request validation, allowing unauthorized cross-origin actions v...

CVE-2021-26033 [20210502] - Core - CSRF in AJAX reordering endpoint

An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint...

CVE-2021-26032

CVE-2021-26032 affects Joomla! 3.0.0–3.9.26. The issue is that HTML was missing from the executable block list checked by MediaHelper::canUpload, enabling cross-site scripting (XSS) vectors. The vulnerability stems from insufficient input filtering in that code path, allowing injected HTML/script...

CVE-2021-26032 [20210501] - Core - Adding HTML to the executable block list of MediaHelper::canUpload

An issue was discovered in Joomla! 3.0.0 through 3.9.26. HTML was missing in the executable block list of MediaHelper::canUpload, leading to XSS attack vectors...